add webauthn routes

src/webauthn/webauthn.route.ts

@@ -0,0 +1,213 @@
+import { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  RegistrationResponseJSON,
+  VerifiedAuthenticationResponse,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse,
+} from "@simplewebauthn/server";
+import { isoUint8Array } from "@simplewebauthn/server/helpers";
+import { getUserByEmail } from "../user/user.service";
+import { createSession } from "../auth/auth.service";
+import { generateOTP } from "../utils/id";
+import { sendMail } from "../utils/mail";
+
+const rpID = process.env.SERVER_DOMAIN;
+const rpName = "Quicker Permits";
+const origin = `http://${rpID}:3000`;
+
+export async function webAuthnRoutes(fastify: FastifyInstance) {
+  fastify.post<{ Body: { email: string } }>(
+    "/register/request",
+    {
+      schema: {
+        body: {
+          type: "object",
+          properties: {
+            email: { type: "string" },
+          },
+        },
+      },
+    },
+    async (req, res: FastifyReply) => {
+      const { email } = req.body;
+
+      if (!email) {
+        return res.code(400).send({ error: "Email is required" });
+      }
+
+      const userInDB = await getUserByEmail(email);
+      if (!userInDB) return res.code(400).send({ error: "not allowed" });
+
+      const otp = generateOTP();
+
+      const userId = userInDB.id;
+      const options = await generateRegistrationOptions({
+        rpName,
+        rpID,
+        userID: isoUint8Array.fromUTF8String(userId),
+        userName: email,
+        attestationType: "none",
+        excludeCredentials: userInDB.passKeys.map((cred) => ({
+          id: cred.credentialID,
+          type: "public-key",
+          transports: cred.transports,
+        })),
+      });
+
+      userInDB.challenge = {
+        value: options.challenge,
+        expiry: new Date(Date.now() + 60 * 5 * 1000),
+      };
+
+      userInDB.otp = {
+        value: otp,
+        expiry: new Date(Date.now() + 60 * 5 * 1000),
+      };
+
+      await userInDB.save();
+
+      const sent = await sendMail(
+        email,
+        "Code for Quicker Permits Authentication",
+        `Your code is ${otp}`
+      );
+      if (!sent) return res.code(500).send({ error: "server error" });
+
+      return res.send(options);
+    }
+  );
+
+  fastify.post<{
+    Body: {
+      email: string;
+      code: string;
+      attestationResponse: RegistrationResponseJSON;
+    };
+  }>("/register/verify", async (req, res: FastifyReply) => {
+    const { email, code, attestationResponse } = req.body;
+
+    const userInDB = await getUserByEmail(email);
+    if (!userInDB) return res.code(400).send({ error: "not allowed" });
+
+    const challenge = userInDB.challenge;
+    const requiredOTP = userInDB.otp;
+
+    if (!challenge || !requiredOTP)
+      return res.code(400).send({ error: "not allowed" });
+
+    if (new Date() > challenge.expiry || new Date() > requiredOTP.expiry)
+      return res.code(400).send({ error: "challenge expired" });
+
+    if (code != requiredOTP.value)
+      return res.code(400).send({ error: "invalid code" });
+
+    try {
+      const verification = await verifyRegistrationResponse({
+        response: attestationResponse,
+        expectedChallenge: challenge.value as string,
+        expectedRPID: rpID,
+        expectedOrigin: origin,
+      });
+
+      if (!verification.verified) {
+        return res.code(400).send({ error: "registration failed" });
+      }
+
+      userInDB.passKeys.push({
+        credentialID: verification.registrationInfo.credential.id,
+        credentialPublicKey: verification.registrationInfo.credential.publicKey,
+        counter: verification.registrationInfo.credential.counter,
+        transports: attestationResponse.response.transports,
+      });
+
+      await userInDB.save();
+
+      return res.code(200).send({ success: "registration complete" });
+    } catch (error) {
+      return res.code(400).send({ error: error.message });
+    }
+  });
+
+  fastify.post<{ Body: { email: string } }>(
+    "/login/request",
+    async (req, res) => {
+      const { email } = req.body;
+
+      const userInDB = await getUserByEmail(email);
+
+      if (!userInDB || userInDB.passKeys.length === 0) {
+        return res.code(400).send({ error: "user not registered" });
+      }
+
+      const options: PublicKeyCredentialRequestOptionsJSON =
+        await generateAuthenticationOptions({
+          rpID,
+          allowCredentials: userInDB.passKeys.map((cred) => ({
+            id: cred.credentialID,
+            type: "public-key",
+            transports: cred.transports,
+          })),
+          userVerification: "preferred",
+        });
+
+      userInDB.challenge.value = options.challenge;
+      userInDB.challenge.expiry = new Date(Date.now() + 60 * 5 * 1000);
+
+      await userInDB.save();
+
+      return res.send(options);
+    }
+  );
+
+  // Authentication Verification (Step 4)
+  fastify.post<{ Body: { email: string; assertionResponse: any } }>(
+    "/login/verify",
+    async (req, res) => {
+      const { email, assertionResponse } = req.body;
+
+      const userInDB = await getUserByEmail(email);
+      if (!userInDB) return res.code(400).send({ error: "not allowed" });
+
+      const challenge = userInDB.challenge;
+      if (!challenge) return res.code(400).send({ error: "not allowed" });
+
+      if (new Date() > challenge.expiry)
+        return res.code(400).send({ error: "challenge expired" });
+
+      try {
+        const credential = userInDB.passKeys.find(
+          (cred) => cred.credentialID === assertionResponse.id
+        );
+
+        if (!credential)
+          return res.code(400).send({ error: "credential not found" });
+
+        const verification: VerifiedAuthenticationResponse =
+          await verifyAuthenticationResponse({
+            response: assertionResponse,
+            expectedChallenge: userInDB.challenge.value as string,
+            expectedRPID: rpID,
+            expectedOrigin: origin,
+            credential: credential,
+          });
+
+        if (!verification.verified)
+          return res.code(400).send({ error: "Authentication failed" });
+
+        credential.counter = verification.authenticationInfo.newCounter;
+
+        const newSession = await createSession(
+          userInDB.id,
+          req.ip,
+          req.headers["user-agent"]
+        );
+
+        res.send({ session_token: newSession.sid });
+      } catch (error) {
+        res.code(400).send({ error: (error as Error).message });
+      }
+    }
+  );
+}